Data Processing Addendum

Customer determines the purposes and means of processing Client Data and acts as the controller or business. TNH acts as Customer's processor or service provider. Those terms have the meanings given by applicable privacy law. The parties' actual activities determine their legal roles.

People and data. Client Data may concern Customer's clients, prospective clients, staff, and authorized users. It includes contact details, appointment records, service preferences, ordinary business notes, consent and communication records, and payment status or transaction references handled through supported payment tools. It excludes the prohibited information described in Section 6.

Purpose and operations. Customer discloses Client Data for hosting its business website and records; managing appointments and authorized user access; sending Customer-authorized reminders and communications; supporting permitted payment integrations; providing support; and protecting the service against fraud and security threats. Operations include receiving, storing, organizing, transmitting, retrieving, exporting, and deleting data for those purposes.

Duration. Processing continues while TNH provides these services and during the limited export, deletion, and lawful retention periods in Section 8. Customer's use of supported features, these Terms, and written directions consistent with the service constitute documented instructions.

TNH will process Client Data only on Customer's documented instructions and for the purposes specified above, except where applicable law requires otherwise. If legally permitted, TNH will notify Customer before required processing outside those instructions. TNH will tell Customer if it reasonably believes an instruction violates applicable data-protection law and may pause the affected processing while the parties resolve the issue.

TNH will not sell Client Data, share it for cross-context behavioral advertising, or use it for TNH's own marketing. TNH will not retain, use, or disclose Client Data outside the direct service relationship or combine it with data from other customers or TNH's own interactions with individuals, except as expressly permitted by applicable privacy law for the specified service purposes.

To the extent the CCPA or another applicable privacy law governs this processing, TNH will comply with its applicable processor or service-provider duties and provide the required level of privacy protection. TNH will notify Customer if it determines it can no longer meet those obligations. Customer may take reasonable steps to verify compliance and, on notice, require unauthorized use to stop and be remedied. Neither party is relieved of duties imposed by law because the other party has a contractual responsibility.

TNH will limit access to personnel and approved providers who need it to perform their duties and are subject to confidentiality obligations. TNH will maintain reasonable safeguards appropriate to the nature of Client Data and processing risks, including encryption in transit, access controls, access logging where supported, and procedures for managing security incidents and provider access. Customer remains responsible for its own user permissions, devices, passwords, and lawful use of available features.

Customer authorizes TNH to use subprocessors for hosting, software functions, messaging, supported payment functions, and support. A current list describing their services and relevant processing locations is available from hello@m.tnhsolutions.biz. Separately contracted providers acting for their own purposes are not subprocessors merely because TNH links to them.

TNH will bind subprocessors to written data-protection obligations appropriate to their work and at least as protective of Client Data as the applicable obligations in this DPA. TNH remains responsible for their performance of the processing obligations it delegates to them.

TNH will give Customer at least 30 days' notice before a new or replacement subprocessor begins processing Client Data. Customer may object during that period on reasonable data-protection grounds by emailing the privacy contact. The parties will seek a reasonable solution. If none is available, Customer may terminate the affected service before the new processing begins and receive a refund of prepaid fees for the unused affected service period. This does not limit any stronger right required by applicable law.

Taking account of the processing and information available to it, TNH will reasonably assist Customer with individual privacy requests, security and breach-notification duties, and required privacy assessments. TNH will provide relevant information in its possession and cooperate with legally required audits and assessments. Customer should submit assistance requests to hello@m.tnhsolutions.biz.

If TNH receives a request concerning Client Data directly from an individual, it will direct the individual to Customer and notify Customer where appropriate, unless law requires TNH to respond directly. TNH will not disclose Client Data to an unverified requester. Customer is responsible for making the substantive decision on requests directed to Customer and giving TNH the instructions needed to implement it.

Customer is responsible for a lawful basis, required notices and consent, accurate instructions, appropriate user access, and honoring individuals' choices. Obtain any necessary permission for text and email messages and maintain evidence of it. Where client records concern minors, obtain any required parental or guardian permission and observe applicable child-privacy requirements.

Do not store Social Security numbers, full payment card details, detailed medical histories, or other sensitive information that TNH Pro is not designed to handle in notes, uploads, messages, or general-purpose fields. Use only the designated payment provider's secure fields for card entry.

Health information. TNH Pro is not offered as a HIPAA-compliant service, and TNH does not enter into Business Associate Agreements. A HIPAA covered entity or business associate must not use TNH Pro to store or process protected health information. This restriction may include appointment, contact, or billing information when it qualifies as protected health information; it is not limited to treatment notes. A business such as a med spa is responsible for determining which rules apply to its activities.

TNH will notify Customer without undue delay after becoming aware of a security incident involving unauthorized access to, acquisition, disclosure, alteration, destruction, or loss of Client Data. TNH will aim to give initial notice within 72 hours of awareness and will comply with any shorter legally required deadline. Initial notice will not be postponed solely because the investigation is incomplete.

As information becomes available, TNH will describe the incident, affected data and individuals where known, likely consequences, mitigation measures, and a contact for follow-up. TNH will take reasonable steps to contain and investigate the incident and provide updates needed for Customer's legal obligations. Customer is responsible for notifications it must make to individuals or regulators, with TNH's assistance, unless law requires TNH to make a notification directly. An incident notice is not an admission of liability.

After account closure, Customer has 30 calendar days to export Client Data through supported tools or request a reasonable export from TNH. Customer may instruct TNH to return or delete Client Data earlier, subject to applicable law. After the export window, TNH will complete deletion from active systems no later than 90 calendar days after account closure. The 90-day deadline includes the first 30 days.

TNH may retain Client Data only to the extent required by law, and will continue to protect and restrict it to that purpose. This does not prevent TNH from keeping its own billing or legal records outside Client Data as described in the Privacy Policy.

Backup copies remain protected, isolated from ordinary use, and subject to deletion through the documented backup cycle. If a backup is restored, TNH will reapply applicable deletion instructions. TNH will provide information about the backup cycle and reasonable confirmation of deletion on request. Any shorter deadline required by applicable law or a valid individual rights request controls.

On reasonable written request, TNH will provide relevant information in its possession needed to demonstrate compliance, such as security questionnaires, descriptions of controls, or available independent assessment summaries, subject to confidentiality and protection of other customers' information.

Where those materials are insufficient or applicable law requires further assessment, TNH will permit and cooperate with a reasonable assessment by Customer or a qualified independent assessor. The parties will agree on reasonable scope, notice, security protections, and scheduling to minimize disruption. Routine assessments should normally occur no more than once per year, but that limit does not apply after a material incident, a substantiated compliance concern, or a regulator's or applicable law's requirement. No assessment authorizes access to unrelated customers' data or unapproved security testing.

This DPA controls over conflicting Terms concerning Client Data. Mandatory legal requirements control over inconsistent contractual limits. Otherwise, the Terms remain in effect. Contact hello@m.tnhsolutions.biz for DPA notices, subprocessor information, privacy assistance, or data-return and deletion requests. Include the business name and account email, but do not include passwords or unnecessary Client Data in messages.